diff --git a/meta-oe/recipes-devtools/android-tools/android-tools/0023-libadbd_auth-optionally-take-the-trusted-key-paths-a.patch b/meta-oe/recipes-devtools/android-tools/android-tools/0023-libadbd_auth-optionally-take-the-trusted-key-paths-a.patch
new file mode 100644
index 000000000000..581ecc85ce09
--- /dev/null
+++ b/meta-oe/recipes-devtools/android-tools/android-tools/0023-libadbd_auth-optionally-take-the-trusted-key-paths-a.patch
@@ -0,0 +1,72 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Alex Kiernan <alex.kiernan@gmail.com>
+Date: Fri, 6 Nov 2026 09:38:18 +0000
+Subject: [PATCH] libadbd_auth: optionally take the trusted-key paths at build
+ time
+
+libadbd_auth reads trusted host keys from /adb_keys and
+/data/misc/adb/adb_keys, which are Android's locations and rarely exist
+on a Linux system - so a Linux adbd that requires authorization has
+nowhere to be given a key.
+
+When ADBD_AUTH_KEY_PATHS is passed to make - a colon-separated list -
+read keys from those files instead. They are still read on every attempt, so a key
+file that appears after adbd started is picked up.
+
+Without the define nothing changes.
+
+Upstream-Status: Pending
+
+AI-Generated: Claude Opus 5.5 (Claude Code)
+Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
+---
+ debian/system/adbd.mk                         |  4 ++++
+ .../native/libs/adbd_auth/adbd_auth.cpp       | 19 ++++++++++++++++---
+ 2 files changed, 20 insertions(+), 3 deletions(-)
+
+diff --git a/debian/system/adbd.mk b/debian/system/adbd.mk
+index 5e2c5ccaea30..dc82b998e77a 100644
+--- a/debian/system/adbd.mk
++++ b/debian/system/adbd.mk
+@@ -113,6 +113,10 @@ ifeq ($(ADBD_AUTH_UNLESS_DEBUGGABLE),1)
+ CPPFLAGS += -DADBD_AUTH_UNLESS_DEBUGGABLE
+ endif
+ 
++ifneq ($(ADBD_AUTH_KEY_PATHS),)
++CPPFLAGS += -DADBD_AUTH_KEY_PATHS='"$(ADBD_AUTH_KEY_PATHS)"'
++endif
++
+ STATIC_LIBS = \
+   debian/out/system/libadb.a \
+   debian/out/system/libcrypto_utils.a \
+diff --git a/frameworks/native/libs/adbd_auth/adbd_auth.cpp b/frameworks/native/libs/adbd_auth/adbd_auth.cpp
+index 78896ed553c4..9b76c17b1b39 100644
+--- a/frameworks/native/libs/adbd_auth/adbd_auth.cpp
++++ b/frameworks/native/libs/adbd_auth/adbd_auth.cpp
+@@ -390,10 +390,23 @@ public:
+         }
+     }
+ 
+-    static constexpr const char* key_paths[] = {"/adb_keys", "/data/misc/adb/adb_keys"};
++#if defined(ADBD_AUTH_KEY_PATHS)
++    // A colon-separated list, for systems where AOSP's locations mean nothing.
++    // Read on every attempt, so a file that appears after adbd started counts.
++    static std::vector<std::string> KeyPaths() {
++        return android::base::Split(ADBD_AUTH_KEY_PATHS, ":");
++    }
++#else
++    static std::vector<std::string> KeyPaths() {
++        return {"/adb_keys", "/data/misc/adb/adb_keys"};
++    }
++#endif
+     void IteratePublicKeys(bool (*callback)(void*, const char*, size_t), void* opaque) {
+-        for (const auto& path : key_paths) {
+-            if (access(path, R_OK) == 0) {
++        for (const auto& path : KeyPaths()) {
++            if (path.empty()) {
++                continue;
++            }
++            if (access(path.c_str(), R_OK) == 0) {
+                 LOG(INFO) << "adbd_auth: loading keys from " << path;
+                 std::string content;
+                 if (!android::base::ReadFileToString(path, &content)) {
diff --git a/meta-oe/recipes-devtools/android-tools/android-tools_35.0.2.bb b/meta-oe/recipes-devtools/android-tools/android-tools_35.0.2.bb
index 1a939b503601..b17d92d6e9bb 100644
--- a/meta-oe/recipes-devtools/android-tools/android-tools_35.0.2.bb
+++ b/meta-oe/recipes-devtools/android-tools/android-tools_35.0.2.bb
@@ -67,6 +67,7 @@ SRC_URI = "https://deb.debian.org/debian/pool/main/a/android-platform-tools/andr
            file://0020-adbd-signal-readiness-once-functionfs-is-serviced.patch \
            file://0021-liblog-optionally-read-ro.debuggable-from-build.prop.patch \
            file://0022-adbd-optionally-require-authorization-unless-the-bui.patch \
+           file://0023-libadbd_auth-optionally-take-the-trusted-key-paths-a.patch \
            "
 
 SRC_URI[orig.md5sum] = "352376965cdef7bd7505d8fefdd43d50"
@@ -223,7 +224,8 @@ do_compile() {
     for tool in ${TOOLS_TO_BUILD}; do
         oe_runmake -f ${S}/debian/system/${tool}.mk -C ${S} \
             ${@'HAVE_SYSTEMD=1' if bb.utils.contains('PACKAGECONFIG', 'systemd', True, False, d) else ''} \
-            ${@'ADBD_AUTH_UNLESS_DEBUGGABLE=1' if bb.utils.contains('PACKAGECONFIG', 'auth-unless-debuggable', True, False, d) else ''}
+            ${@'ADBD_AUTH_UNLESS_DEBUGGABLE=1' if bb.utils.contains('PACKAGECONFIG', 'auth-unless-debuggable', True, False, d) else ''} \
+            ${@'ADBD_AUTH_KEY_PATHS=' + d.getVar('ADBD_AUTH_KEY_PATHS') if d.getVar('ADBD_AUTH_KEY_PATHS') else ''}
     done
 }
 
@@ -271,6 +273,9 @@ BBCLASSEXTEND = "native"
 
 PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
 ADB_DEBUGGABLE_PROP_FILES ?= "${sysconfdir}/build.prop"
+# Where adbd reads trusted host keys, colon-separated. Empty keeps Android's
+# /adb_keys and /data/misc/adb/adb_keys.
+ADBD_AUTH_KEY_PATHS ?= ""
 # Apply Android's fs_config ownership/mode tables to files pushed by adbd to
 # /system, /vendor and /oem. Off by default: the tables describe Android
 # partition images and are meaningless on a generic Linux rootfs.